Chat now with support
Chat with Support

Change Auditor 7.1.1 - Installation Guide

Installation Overview Install Change Auditor Add Users to Change Auditor Security Groups Connecting to the Clients Deploy Change Auditor Agents Upgrade Change Auditor Installation Notes and Best Practices Multi-Forest Deployments Foreign Forest Agent Deployment Workstation Agent Deployment Agent Comparison Install an agent to audit ADAM (AD LDS) on workgroup servers Active Roles Integration Quest GPOADmin Integration Windows Installer Command Line Options

Workstation Agent Deployment

Workstation agents are required to capture login activity events when a Change Auditor for Logon Activity Workstation license is applied. This section provides recommendations for deploying agents necessary for auditing both domain workstations and non-domain workstations. It also includes instructions on manually deploying workstation agents.

•
Recommendations and deployment requirements
•
Manual workstation agent deployment
•
Deploying workgroup agents (non-domain workstations)

 

Recommendations and deployment requirements

All workstation agents
•
See the Release Notes for a full list of the minimum system requirements for workstation agents.
•
Quest recommends a phased approach to deploying workstation agents. Deploying a maximum of 100 workstation agents at a time allows you to monitor the coordinator performance before deploying another batch of agents
Deploying workstation agents (domain workstations)
•
The recommended installation is from the Deployment tab of the client. See Change Auditor agents.
•
Alternately, you can manually deploy workstation agents. See Manual workstation agent deployment.
Deploying foreign forest workstation agents (domain workstations)
•
The recommended installation is from the Deployment tab of the client. See Deploying foreign forest agents.
•
Alternately, you can manually deploy workstation agents. See Manual workstation agent deployment.

Manual workstation agent deployment

When installed manually, the workstation agent installer must be run as an account with the local administrator account privileges and with elevated User Account Control (UAC) permissions.

* 
NOTE: Depending on the UAC policies (see User Account Control (UAC) Settings), elevated UAC permissions may require starting the installer using one of the following methods:
•
Shift + Right-click installer to select ‘Run as a different user’
•
From the Windows Task Manager, select File | Run New Task, browse and select the Change Auditor Workstation Agent installer file, and select the ‘Create this task with administrative privileges’ option, then click OK.
To manually install a workstation agent:
1
Copy the appropriate agent installer package from the Change Auditor service installation directory to the workstation to monitor. The default directory is %ProgramFiles%\Quest\ChangeAuditor\Service\Change Auditor Workstation Agent (x64).msi.
2
Run the installer file on the workstation to open the Workstation Agent Setup wizard which steps you through the installation.
3
If the computer is member of the local forest where coordinator resides, select This agent connects to a coordinator in the local forest. If the computer is a workgroup member or member of a foreign forest where no coordinator resides, select This agent connects to a coordinator in a foreign forest. For more information see Installing agents in a foreign forest.
4
The Installation Name screen prompts you to enter the installation name to identify the database where the coordinator is located. Click Browse to select the required installation.
5
Choose the destination folder and click Next.
6
Click Next to begin the installation.
User Account Control (UAC) Settings
•
UAC policies typically use different settings for the ‘Administrator’ account and other accounts with Administrative privileges, so it may be easier to run the Change Auditor Workstation Agent installer with elevated UAC permissions if the Administrator account is used.
•
General UAC elevation and prompt level configurations can be accessed through the Control Panel User Access Control configuration.

•
More specific UAC policies can be configured in the Local Security Policy or a Group Policy Object (where appropriate) to determine whether all Administrators or the built-in Administrator account are run in Admin Approval Mode, the elevation prompt level, whether the secure desktop is used for prompting, whether elevation is possible without prompting, and so forth.

Deploying workgroup agents (non-domain workstations)

•
A workgroup agent requires NetBIOS over TCP enabled and access to the following ports inbound to the domain controllers:
•
UDP port 137 (name services)
•
UDP port 138 (datagram services)
•
TCP port 139 (session services)
•
A routable network path must exist between the workgroup computer, domain controllers, and the coordinator servers. Name resolution of domain controllers and the coordinator servers is also required from the non-domain computer, whether DNS server configuration, NetBIOS/WINS configuration or local hosts file entries are used.
•
Agents must be deployed manually. See Manual workstation agent deployment.
•
During installation, the agent installer prompts for Active Directory domain and credential information to locate a coordinator and installation name.
•
When the first agent is installed on workgroup computer, a ChangeAuditor Agents - <InstallationName> security group is created. User accounts must be added to this security group to properly authenticate.
•
The agent installer allows you to add the domain user account to the ChangeAuditor Agents – <InstallationName> security group, if appropriate LDAP and network protocol access is available.
* 
NOTE: Sometimes, you might need to pre-stage\create the ChangeAuditor Agents – <InstallationName> security group and manually add the configured workstation agent user account to the security group.
•
You can also use the Coordinator Credential Configurator to change between coordinator domains at any time after the agent is installed.
* 
NOTE: The Coordinator Credential Configurator application can be launched using the CoordinatorCredentialConfigurator.exe file in the agent installation folder on the workstation. The default agent installation location is: %ProgramFiles%\Quest\ChangeAuditor\Agent

 

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating